Topic starter
24/06/2026 10:32 pm
TL;DR: Identity governance is being pulled into business continuity, compliance and transformation decisions as cloud adoption, third-party risk and autonomous agents widen the access surface, SailPoint and KPMG argue. Runtime access rules now have to prove who can act, for what reason and under whose control.
Editorial analysis by NHI Mgmt Group, based on content published by SailPoint: “A conversation with KPMG: Identity security, AI governance & third-party risk”.
By the numbers:
- 60% of breaches being identity-based
Key questions
Q: Why do autonomous agents change identity governance more than chatbots do?
A: Because the risk moves from generated content to real access.
A: Yes. Organisations should start with a governance layer that gives them visibility into identities, entitlements, and application access, then extend privileged controls where the highest risk exists. That sequence helps teams establish policy, approvals, and review discipline before they manage elevated access at scale. It also makes later PAM expansion easier to operationalise.
Q: What breaks when third-party access is not lifecycle managed?
A: Access outlives accountability.
Practitioner guidance
- Audit third-party access lifecycles Inventory vendor, partner and outsourced accounts across connected platforms, then tie each one to an owner, business purpose and offboarding trigger.
- Separate AI agent access from human access Create a distinct governance path for autonomous agents so their entitlements, approvals and logging are not forced into human access review cadences.
- Rework access reviews for hybrid environments Focus recertification on active business relationships, system touchpoints and stale delegated access, not on identity lists alone.
Bottom line: Identity governance is being pulled into continuity, compliance and transformation decisions as external access and AI-driven actors expand the control surface.
Glossary terms: Access-rights provenance, Third-Party Identity, Runtime Access Control, Identity Governance
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 1 day ago by NHI Mgmt Group
25/06/2026 7:15 am
Identity governance is becoming the control plane for enterprise resilience. The article shows that identity has moved from a permissions topic to a business continuity topic because cloud integration and external access now shape operational continuity. That is a material shift for governance models built around periodic access review alone. The practitioner conclusion is that identity programmes must be evaluated by how well they preserve service continuity under change, not just by how many reviews they complete.
A few things that frame the scale:
- Only 44% of organisations have implemented any policies to manage their AI agents, despite 92% agreeing that governing AI agents is critical to enterprise security, according to the 2026 Infrastructure Identity Survey.
A question worth separating out:
Q: What is the difference between runtime authorization and access reviews for agents?
A: Access reviews look backward at entitlements already granted, while runtime authorization controls the action before it happens. For AI agents, that distinction matters because the risky decision often occurs after access is approved, when the agent selects a tool or data source that changes the scope of the session.
👉 Read our full editorial: Identity security, AI governance and third-party risk are converging